TSA SD 1580/82

No changes recorded yet — we are watching, and nothing has been published.

1. 2027-05-02 in 174 days SD 1580/82-2022-01E expires unless TSA renews or replaces it
2. 2026-05-03 SD 1580/82-2022-01E takes effect
3. 2025-02-05 Comment period closes on TSA's proposed rule "Enhancing Surface Cyber Risk Management", which would impose cyber risk management requirements on certain pipeline and rail owner/operators
4. 2024-11-07 TSA publishes the proposed rule "Enhancing Surface Cyber Risk Management"
5. 2022-10-27 TSA corrects the submission email address in SD 1580/82-2022-01

1. 2026-05-03
   SD 1580/82-2022-01E RevisionCurrent

   Renewal effective 3 May 2026 through 2 May 2027, superseding 01D; TSA states there are no substantive revisions. source

   More

   • Changes are limited to the effective date, expiration date, series letter and formatting corrections.
2. 2025-05-03
   SD 1580/82-2022-01D Revision

   Renewal effective 3 May 2025 through 2 May 2026, superseding 01C, with no substantive revisions. source

3. 2024-07-01
   SD 1580/82-2022-01C Errata

   Correction to 01B issued on industry feedback; the expiration date of 2 May 2025 was not affected. source

   More

   • Added the definition of "business critical functions", unintentionally omitted from 01B.
   • Clarified that railroads subject to certain physical security rules for locomotives may rely on those measures for PTC components installed on locomotives (Section III.C.6).
4. 2024-05-02
   SD 1580/82-2022-01B Revision

   The revision that took effect on 2 May 2024 and was due to expire on 2 May 2025. source

5. 2023-10-24
   SD 1580/1582-2022-01A Revision

   Effective 24 October 2023 through 24 October 2024, superseding the original directive with changes TSA summarised in a table. source

   More

   • New Section II.A.2 clarifies the owner/operator's responsibility where security measures are delegated to or shared with a managed security service provider.

Freight railroads under 49 CFR 1580.101 and other railroads TSA designates, for their Critical Cyber Systems.

Freight railroads

Freight railroad owner/operators within 49 CFR 1580.101: Class I freight railroads, those carrying specified security-sensitive materials in high threat urban areas, and host railroads to them or to covered passenger operations. source source

Designated railroads

Additional freight and passenger railroads that TSA notifies based on a risk determination; TSA gives them specific compliance deadlines. source

Scope

Critical Cyber Systems; a railroad that determines it has none must notify TSA in writing within 60 days of the effective date. PTC systems must be included where PTC is installed and operated. source

Service providers

Where measures are delegated to a managed security service provider, the owner/operator retains sole responsibility for compliance. source

Companion directive

The directive generally applies to the same railroads as the SD 1580-21-01 series, "Enhancing Rail Cybersecurity". source

TSA approves each railroad's Cybersecurity Implementation Plan and inspects against it; the Cybersecurity Assessment Plan is updated and reported on every year.

Implementation Plan

Railroads establish a TSA-approved Cybersecurity Implementation Plan covering network segmentation, access control, continuous monitoring and detection, and risk-based patching; it sets the measures TSA inspects against. source

Assessment Plan

The initial Cybersecurity Assessment Plan is due within 60 days of plan approval; updates and a report of results are submitted annually. source

Assessment coverage

At least one third of the plan's policies, procedures, measures and capabilities are assessed each year, and all of them over any three-year period. source

Architecture review

A cybersecurity architecture design review within 12 months of plan approval and at least once every two years after that. source

TSA inspects for compliance against each railroad's approved plan and may inspect or copy its records; owner/operators answer for their Authorized Representatives.

Inspection

Under 49 U.S.C. 114(f) TSA enforces security requirements and inspects; the approved plan sets the measures TSA inspects against, and records needed to establish compliance must be available to TSA on request. source

Liability

Both owner/operators and their Authorized Representatives are liable for non-compliance on the part of the Authorized Representative. source

1. Law text SD 1580/82-2022-01E — Rail Cybersecurity Mitigation Actions and Testing, with transmittal memo
2. Guidance TSA Security Directives and Emergency Amendments (all issues)
3. Law text SD 1580-21-01E — Enhancing Rail Cybersecurity
4. Law text Enhancing Surface Cyber Risk Management — proposed rule (89 FR 88488)

1. MTSA Cybersecurity

   The Coast Guard's codified cybersecurity rule for vessels and port facilities, rather than a renewable TSA directive for railroads.

2. NERC CIP

   Mandatory cybersecurity standards for the bulk power system, approved by FERC; the TSA directive covers railroads.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to TSA SD 1580/82 (RSS)